191–200 of 368 posts
Crypto has single handedly created a very large malware industry and has also made information security a massive industry. Ban crypto and both industries will become way, way smaller.
[flagged]
Earlier quoted context omitted.
> Do we, really? Yes, or pretty close to it. What we don't know how to do (AFAIK) is do it at a cost that would be acceptable for most software. So yes, it mostly gets done for (components of) planes, spacecraft, medical devices, etc. Totally agreed that most software is a morass of bugs. But giving examples of buggy software doesn't provide any information about whether we know how to make non-buggy software. It onl…
There is a huge wetware problem too. Like if I can send you an email or other message that tricks you and gets you to send me $10k, what do I care if the industry is 100% effective at blocking RCE?
Earlier quoted context omitted.
You assume that PMs will just accept whatever estimate you give and not just say 2 weeks from the off and refuse to budge.
So, could you say "ok, but I still can't do that"
Whenever I look at a web project, it starts with "npm install" and literally dozens of libraries get downloaded. The project authors probably don't even know what libraries their project requires, because many of them are transitive dependencies. There is zero chance that they have checked those libraries for supply chain attacks.
So how was this attack gonna generate "revenue" for the attacker? What kind of info did they get hold of?
It was quite instructive on how all the various pieces of code protected each other for persistence, including removing competing malware. From analysing the code it alerted me to the hidden backup in the database that is triggered by the WordPress cron, and would reinfect the site should any of the PHP code be removed.
There is apparently a dark web marketplace for access to persistently compromised websites. Generally they end up getting used to email or display a phishing attack. In the case I fixed they had sold access to someone to inject a fake Cloudflare security popup with instructions to run some code in Windows PowerShell.
Earlier quoted context omitted.
They're adding backlinks to other sites. They're either making revenue from those sites, or (more likely) selling backlinks to unsavory products.
Article: "It only showed the spam to Googlebot, making it invisible to site owners." - so it was really only about SEO for themselves or their customers. With regards to "Your Ad Here" type services using crypto: are Adshares, Coinzilla, Bitmedia or A-Ads any good? Perhaps micropayments are what makes this space interesting right now. I suppose it's the "unsavory" aspect of the things being peddled that can make it h…
Crypto has single handedly created a very large malware industry and has also made information security a massive industry. Ban crypto and both industries will become way, way smaller.
Might as well eliminate the attack surface entirely, and ban computing.
Earlier quoted context omitted.
The fundamental problem remains: it’s difficult to predict how long it will take to solve a series of puzzles. I worked in a dev group where we’d take the happy path estimate and double it… it didn’t help much. So often I’d think something would take me a week, so two walls was allotted, but I made a discovery in my first like hour/day whatever that reduced the dev time to like a couple days. Then, there were tasks t…
That's the point I am making, and the point of asking "what is the alternative" Developers aren't alone in adhering to schedules. Many folks in many roles do it. All deal with missed deadlines, success, expectation management, etc. No one operates in magical no-timeline land unless they do not at all answer to anyone or any user. Not the predominant model, right? So rather than just say "you can blame the PMs" I'd lo…
This is interesting, because not only was this not a hack (someone bought the plugin and changed its operation), it's something that would be solved by a separate solution I have to security vulnerabilities in general. A software building code could provide a legal framework to hold someone liable for transferring ownership of a software product and significantly altering its operation without informing its users. Th…